Bit of a quirky virus related problem I experienced on a friends computer.
Basically windows will boot to the logon screen. Once you select a user no matter who you select it will say Loading Personal Settings and then the screen will just display the wallpaper. No icons. Nothing.
I could press CTRL + ALT + DELETE and load up task manager. So I then loaded up a command prompt from there.
When I then ran explorer.exe an error message came up saying :-
system cannot find the file explorer.exeChecking the windows folder I could see the explorer.exe file.
To resolve the issue I took the following steps.
[ad]
– Boot Windows into safe mode
– Login as administrator
– When blank screen press CTRL + ALT + DELETE
– Click on file, run
– regedit.exe
– Navigate to this key
– HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe
– Delete this key
When I tried to delete this key I got an access denied error message. On closer inspection I found that the permissions on the key had been altered so noone had permission to delete it.
In order to delete it I had to do the process below :
– Navigate to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
– Right click on the Image File Execution Options
– Click Permissions
– Click on advanced button
– Click on owner
– Tick the box “replace owner on subcontainers and objects”
– Click Ok
– Click Ok Again
– Repeat process Right click on the Image File Execution Options
– Click Permissions
– Click on advanced button
– Tick the box “replace permission entries on all child objects”
– Click ok
– Click ok
You should now be able to delete the key.
Also delete the key for iexplorer.exe if you have one
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplorer.exe
Now reboot and it should login as normal. You can now cleanse the machine. FUN!!!